Freedom251 › Network Protocol Analyzers
OpenGrep
What OpenGrep is
OpenGrep is a free, open-source static analysis engine for finding security issues and searching source-code patterns. It runs on Linux, macOS and Windows, and supports more than 30 languages, including Python, Java, JavaScript, Go, Rust, PHP and Visual Basic. Existing Semgrep rules and rulesets work unchanged. Its intrafile taint analysis tracks constructor and field assignments, flow between methods, higher-order functions across 12 languages, and collection methods such as map, filter and reduce. OpenGrep produces JSON and SARIF output and documents a CI subcommand for workflow use. The project distributes self-contained binaries and says releases are signed with Cosign. Deployment is self-hosted, and the project invites developers and organizations to use and contribute to the engine. OpenGrep is a Semgrep fork under the LGPL 2.1 license. Its security policy asks users to report vulnerabilities by email and lists only the latest version as supported.
Who it suits
OpenGrep suits developers and organizations looking for a self-hosted code analysis engine across several operating systems. It is also relevant to teams with existing Semgrep rules or workflows that use JSON, SARIF or CI.
What it does well
- Supports more than 30 programming languages.
- Existing Semgrep rules work unchanged.
- Includes intrafile taint analysis.
- Outputs JSON and SARIF.
- Runs on Linux, macOS and Windows.
What to know first
- Deployment is self-hosted.
- Security policy supports only the latest version.
Limits
The security policy lists only the latest version as supported.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| OpenGrep | Open-source static analysis engine; CLI | Free |
As github.com lists them, read 3 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the OpenGrep GitHub repository.
- Choose the installation instructions for Linux, macOS, or Windows.
- Install a self-contained binary for your system.
- Use the CLI and CI subcommand to incorporate analysis into a workflow.
- Choose JSON or SARIF output for workflow integration.
Verdict
OpenGrep pairs broad language support with Semgrep rule compatibility and multiple analysis outputs. Note that deployment is self-hosted and the security policy covers only the latest version.
Questions
Is OpenGrep free?
Yes. The OpenGrep plan is free.
Which systems does OpenGrep support?
Installation instructions are provided for Linux, macOS, and Windows.
Is OpenGrep open source?
Yes. It is an open-source fork of Semgrep under the LGPL 2.1 license.
Can OpenGrep use Semgrep rules?
Yes. Existing Semgrep rules and rulesets work unchanged.
Does OpenGrep support CI/CD?
Yes. It supports CI/CD and documents a CI subcommand.
Which output formats does OpenGrep provide?
It supports JSON and SARIF output.
Facts from OpenGrep's own pages
- Analysis features
- Its intrafile taint analysis supports constructor and field assignment tracking, inter-method taint flow, higher-order functions across 12 languages, and collection methods such as map, filter, and reduce. · github.com, 3 Oct 2026
- Build requirements
- Developer builds require OCaml 5.5.0, dune, opam, a C toolchain, PCRE and GMP libraries, make and git. · github.com, 15 Oct 2026
- Changelog: 1.28.0
- The 26 August 2026 release improved install scripts, fixed Windows output handling, updated constant propagation and added PHP fixes. · github.com, 15 Oct 2026
- Changelog: 1.29.0
- The 28 August 2026 release migrated remaining PCRE1 uses to PCRE2 and fixed Kotlin scope-function taint desugaring. · github.com, 15 Oct 2026
- Company size
- LinkedIn lists Opengrep as a nonprofit software-development organization with company size of one employee. · linkedin.com, 15 Oct 2026
- Consortium
- The project says Aikido Security, Amplify, Endor Labs, Kodem, Orca Security and other application-security organizations support it. · opengrep.dev, 15 Oct 2026
- Developer API
- The docs.rs package documents a Rust Config and SearchEngine API with parallel searches, JSON serialization and optional AI analysis. · docs.rs, 15 Oct 2026
- Directory API listing
- VentureGaps lists a REST API and nine integrations, including GitHub, GitLab CI/CD, CircleCI, Jira, Bitbucket, Jenkins, Slack and GitHub Actions. · venturegaps.com, 15 Oct 2026
- Distribution
- Releases are self-contained OCaml binaries for multiple architectures, so Python is not required. · github.com, 15 Oct 2026
- Documentation
- The repository links a wiki with tutorials and language guides, including intrafile tainting, higher-order functions, C#, PHP and Visual Basic. · github.com, 15 Oct 2026
- Free availability
- The project says consortium members build the engine for free use and intend to keep it free and open-source. · opengrep.dev, 15 Oct 2026
- Governance
- The project says contributions are reviewed on merit and is backed by an application-security consortium that includes Aikido Security, Amplify, Endor Labs, Kodem, and Orca Security. · opengrep.dev, 3 Oct 2026
- Independent context
- Latio Pulse describes Opengrep as a forever-open-source alternative sponsored by more than ten security vendors and says Semgrep's SaaS management features were lacking in the author's experience. · pulse.latio.tech, 15 Oct 2026
- Independent criticism
- Crash Override argues that the consortium had made few significant contributions to Semgrep and characterizes the fork as self-serving. · crashoverride.com, 15 Oct 2026
- Installation
- The official installer supports Linux and macOS through install.sh and Windows through PowerShell install.ps1. · github.com, 15 Oct 2026
- Integration: Aptori
- Aptori runs OpenGrep through its aptori/scanners container and publishes results to the Aptori Platform. · docs.aptori.dev, 15 Oct 2026
- Integration: Deckhouse
- Deckhouse Code runs opengrep_sast_scan and opengrep_sast_junit jobs, publishes JSON and JUnit results, and can forward findings to DefectDojo. · deckhouse.io, 15 Oct 2026
- Integration: Docker
- A community Docker Hub image documents scans through Docker, GitHub Actions, GitLab CI and Docker Compose with JSON or SARIF output. · hub.docker.com, 15 Oct 2026
- Integrations
- The repository documents a CI subcommand, and its output formats include JSON and SARIF. · github.com, 3 Oct 2026
- Intended users
- The project invites developers and organizations to use and contribute to its open static analysis engine. · opengrep.dev, 3 Oct 2026
- Intrafile taint
- The engine adds intrafile cross-function taint analysis with higher-order-function support. · github.com, 15 Oct 2026
- Language coverage
- The README lists more than 30 languages, including Apex, Bash, C, C++, C#, Go, Java, JavaScript, PHP, Python, Ruby, Rust, Swift, Terraform, TypeScript, Visual Basic, XML and YAML. · github.com, 15 Oct 2026
- Language support
- The project says it supports 30+ languages, including Python, Java, JavaScript, Go, Rust, PHP, and Visual Basic. · github.com, 3 Oct 2026
- Licence
- The repository identifies the software as licensed under LGPL-2.1. · github.com, 15 Oct 2026